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INTRODUCTION 


This  report  is  produced  by  INPUT  as  part  of  its  Management  Planning  Program 
in  Information  Systems.  The  report  presents  information  based  on  interviews 
with  30  users  of  computers.  In  six  cases,  information  from  vendors  was  used 
to  supplement  user  interviews. 

Information  from  related  INPUT  studies,  Selling  Personal  Computers  to  Large 
Companies  and  Trends  in  Delivery  of  Remote  Computing  Services,  has  been 
used  to  illustrate  and  amplify  specific  points  throughout  the  report. 

Additional  organizations,  clients,  and  vendors  were  polled  to  review  findings 
and  future  directions  relevant  to  the  study. 

The  results  of  the  study  are  intended  to  serve  the  planning  functions  of  clients 
by  suggesting  trends  and  changes  that  are  occurring  in  strongly  centralized 
data  processing  organizations,  discussing  problems  that  occur,  and  presenting 
approaches  for  addressing  them. 

They  should  not  be  taken  as  predictive  of  any  individual  organization's 
results  under  a different  set  of  circumstances. 

However,  they  do  present  a compendium  of  approaches  that  has  been 
tried  and  found  to  be  successful  in  specific  situations. 

Client  inquiries  on  the  report  are  invited. 
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I!  EXECUTIVE  SUMMARY 


I! 


EXECUTIVE  SUMMARY 


A.  BACKGROUND 


• Increasing  amounts  of  total  organization  EDP  expenditures  are  made  directly 
by  end  users,  and  include  not  only  the  direct  use  of  remote  computing  services, 
but  also  the  acquisition  of  computing  equipment  and  operation  of  systems. 

Large  standalone  minicomputers  can  be  found  in  user  areas  running 
applications  that  could  have  been  handled  in  a central  installation  or 
with  distributed  data  processing  (DDP). 

Smaller  computers  and  office  automation  systems  have  frequently  been 
acquired  by  users  to  meet  local  office  or  departmental  needs. 

Data,  voice,  and  image  communication  systems  are  now  being  acquired 
by  users  as  well. 

• These  user-operated  systems  and  equipment  may  have  been  obtained  because 
they  provide  the  most  economic  means  of  serving  needs,  whether  considered  in 
the  local  context  or  in  that  of  the  entire  organization. 

However,  it  is  more  likely  that  there  was  no  review  by  the  EDP  staff  or 
a steering  committee  to  guide  these  acquisitions. 
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Expenditures  for  information  systems  by  user  areas  and  EDP  cannot  be  totally 
or  easily  aggregated,  as  the  INPUT  study  Changing  Economics  in  the 
Information  Organization  found  earlier  this  year. 

Most  organizations  are  leaning  more  heavily  on  EDP  as  a result  of  the 
increasing  use  of  computing  for  both  the  survival  and  growth  of  the 
organization. 

On-line  systems  magnify  this  reliance  on  computing  since  they  change 
the  methods  of  doing  business. 

While  reliance  on  EDP  systems  is  increasing,  uncoordinated  expansion  of  the 
number  and  size  of  user  systems  has  led  to  difficulties  and  even  an  inability  to 
plan  the  continued  EDP  support  of  business  objectives  of  the  total 
organization. 

EDP  and  corporate  management  in  some  organizations  have  already  taken 
steps  to  alleviate  the  situation,  including: 

Increases  in  procurement  controls. 

Changes  in  organization. 

Improvement  in  the  services  and  methods  of  the  EDP  organization. 
Results  of  these  approaches  are  detailed  and  analyzed  in  the  report. 


FINDINGS 

The  existence  of  user-operated  systems  and  equipment  was  reported  by  all  30 
respondents  to  the  study  and  is  common  in  most  large  companies. 
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Estimates  of  the  relative  size  of  user  expenditures  compared  to  the  budget  of 
the  EDP  department  are  shown  in  Exhibit  1 1- 1 together  with  the  type  of  user- 
operated equipment  that  is  found  in  each  of  the  classes  shown. 

As  the  exhibit  indicates,  remote  services  and  standalone  computers  are 
the  most  prevalent  user-operated  systems.  Each  was  mentioned  by  26 
respondents. 

. However,  the  level  of  use  of  remote  services  was  reported  to  be 
shrinking  at  a number  of  organizations  who  were  converting  work 
to  internal  timesharing. 

Thirteen  of  the  26  respondents  with  standalone  computers  have  micro- 
as  well  as  minicomputers. 

Internal  timesharing  is  the  prevalent  or  only  user-operated  system  more  often 
where  user  expenditures  are  relatively  small. 

Internal  timesharing  services  priced  at  the  level  of  higher  cost  vendor 
services  (and  also  sold  externally)  are  not  the  user-operated  system  of 
choice  as  often  as  where  internal  timesharing  is  priced  closer  to  cost, 
and  better  service  is  provided. 

User  operated  systems  and  equipment  are  almost  as  apt  to  have  been  justified 
by  a cost/benefit  analysis  as  by  arguments  that  the  user  could  not  wait  for 
assistance  by  EDP  or  required  rapid  development  of  a system.  Both  reasons 
were  used  by  about  80%  of  the  respondents. 

However,  problems  are  frequently  encountered  with  user-operated  systems  and 
equipment,  as  listed  below: 

User  needs  are  not  met. 

Corporate  accounting  conventions  are  not  met. 
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EXHIBIT  11-1 


DISTRIBUTION  OF 

COMPUTING  CAPABILITIES  EMPLOYED  IN  USER  SYSTEMS 


CATEGORY 

SIZE  OF  USER  COMPUTING  BUDGET  COMPARED  TO 
EDP  DEPARTMENT  BUDGET 

<1% 

1-5% 

5-10% 

10-20% 

20-30% 

30-40% 

>40% 

TOTAL 

NUMBER  OF 
RESPONDENTS 

7 

10 

3 

3 

4 

1 

2 

30 

NUMBER  WITH  NO 
CONTROLS 

1 

- 

2 

1 

3 

- 

1 

- 

NUMBER  USING 
REMOTE  SERVICES 

6 

7 

3 

3 

4 

1 

2 

26 

NUMBER  WITH  DDP  OR 
INTERNAL  NETWORKS* 

4 

5 

0 

2 

3 

1 

1 

16 

NUMBER  WITH  STAND- 
ALONE COMPUTERS 

3 

10 

3 

3 

4 

1 

2 

26 

NUMBER  WITH  INTERNAL 
TIMESHARING 

4 

5 

2 

3 

1 * * 

•j  ** 

1 

17 

* OTHER  THAN  INTERNAL  TIMESHARING 

**  PRICED  AT  LEVEL  OF  HIGHER  COST  VENDOR  SERVICES  AND  SOLD  EXTERNALLY. 
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User  applications  cannot  be  moved  or  used  elsewhere  in  the  company. 
Operating  problems  are  encountered  in  running  jobs. 

Equipment  and  software  problems  are  encountered. 

Software  packages  recommended  by  the  firm,  such  as  a standard  DBMS, 
cannot  be  used. 

Users  of  these  systems  become  a burden  to  EDP  management. 

• Problems  were  more  frequently  mentioned  by  respondents  where  users  spend  a 
relatively  greater  amount  or  where  there  are  no  controls  in  effect,  as  shown  in 
Exhibit  11-2. 

• Avoiding  problems  was  mentioned  as  a reason  for  increasing  controls  by  67% 
of  the  respondents  who  had  done  so,  but  it  was  not  the  most  important  reason. 
Ninety-one  percent  of  respondents  felt  that  serving  business  strategies  was  a 
more  important  objective,  and  83%  felt  that  supporting  EDP  plans  was  second 
in  importance. 

• Types  of  controls  that  were  increased  can  be  categorized  as: 

Technical  standards  for  equipment,  software,  data  communication,  and 
development  tasks  (requirements  phase  through  documentation  phase). 

Budgetary  or  financial  controls  on  all  computer-related  expenditures,  or 
at  least  on  those  above  a certain  level. 

Independent  review  of  all  computer-related  expenditures  and  requests 
for  computing  capabilities. 

The  provision  of  consulting  and  "marketing"  of  other  services  and  aid 
available  from  the  EDP  department. 
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EXHIBIT  11-2 


PROBLEM  OCCURRENCE  IN  USER  SYSTEMS 


0 1 2 3 4 5 6 7 8 9 10  11  12  13  14  15 

SEVERITY  RATING* 


ENTIRE  CLASS 


IJIil  THOSE  WITHOUT 
CONTROLS 


* SUM  OF  PROBLEMS  TIMES  WEIGHT  OF  PROBLEMS  (HIGH  = 3,  MEDIUM  = 2,  LOW  = 1) 
NUMBER  OF  USERS  IN  CLASS 
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The  latter  two  approaches  are  referred  to  collectively  hereafter  as 
"other  techniques." 

Seventy-five  percent  of  respondents  considered  budgetary  or  financial  controls 
and  review  techniques  to  be  highly  effective  in  guiding  or  controlling  user 
activities. 

All  those  who  felt  their  overall  success  with  controls  is  wholly  or  better 
than  partially  successful  considered  financial  controls  to  be  highly 
effective. 

How  well  each  of  the  objectives  of  increased  controls  are  met  is  shown  in 
Exhibit  11-3. 

No  respondent  felt  that  controls  are  a failure  or  counterproductive. 

As  shown  in  Exhibit  11-4,  the  control  process  is  aided  by  other  factors, 
particularly  in  those  organizations  which  reported  the  greatest  degree  of 
success. 

The  nature  of  these  contributing  factors  indicates  that  increased 
controls  alone  may  not  be  sufficient  to  alleviate  all  problems  associated 
with  user-operated  equipment. 

Ninety-one  percent  of  respondents  anticipate  that  future  technological 
developments  and  accompanying  demands  of  users  will  require  definite  limita- 
tions on  the  choice  of  applications  and  data  communication  software  and 
hardware  capabilities. 

The  anticipated  developments  include  lower  cost  computers  (mini  and  micro) 
with  advanced  communications  data  base  capabilities  and  storage  devices 
performing  development  work  on  internal  timesharing,  and  personal  computers 
that  will  be  more  powerful,  smaller,  less  expensive  and  that  will  provide 
features  of  interest  to  users  as  individuals. 
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EXHIBIT  11-3 


EVALUATION  OF  SUCCESS  OF  INCREASED  CONTROLS 
BY  PERCENT  OF  RESPONDENTS  WHO  INCREASED  CONTROLS 
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EXHIBIT  11-4 


FACTORS  AIDING  THE  CONTROL  PROCESS 


RESPONDENTS  WHO 
HAVE  MET  OBJEC- 
TIVES 


RESPONDENTS  WHO 
HAVE  ALMOST 
MET  OBJECTIVES 


RESPONDENTS  WHO 
HAVE  PARTIAL 
SUCCESS 


RESPONDENTS  WITH 
LIMITED  SUCCESS 


* FACTOR 


DEVELOPMENT  OF  A MISSION  STATEMENT 
MARKETING  ATTITUDE  UTILIZED  BY  EDP 
INTERNAL  TIMESHARING  AVAILABLE 
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c. 


RECOMMENDATIONS 


• Where  users  are  already  operating  systems  and  acquiring  equipment,  the  EDP 
organization  and/or  top  management  must  find  out  why. 

The  EDP  department  may  have  a backlog  of  work  that  inhibits  the 
submission  of  worthwhile  user  requests.  EDP  might  need  more  budget 
or  personnel,  or  might  need  to  become  more  productive.  Internal 
timesharing,  or  DDP,  or  the  ability  to  use  remote  services  could  allow 
users  to  meet  some  of  their  own  needs  as  well. 

. These  approaches  need  not  threaten  the  EDP  department's 
control,  and  often  can  aid  it. 

The  EDP  department  may  not  be  working  closely  enough  with  users  to 
stay  aware  of  and  participate  in  their  plans  for  the  use  of  computing. 

. The  EDP  department  may  have  to  revise  its  budget,  or  improve 
both  its  willingness  to  cooperate  or  its  "salesmanship"  approach. 

EDP  may  consume  an  excessive  amount  of  time  and/or  cost  for 
development  work. 

. Productivity  methods  and  tools  might  be  explored. 

. Measurement  and  costing  techniques  may  need  to  be  investigated 
and  changed  or  developed. 

EDP  may  not  have  up-to-date  knowledge  of  the  technology  or  software 
packages  that  are  available  to  meet  user  needs. 

. Education  as  well  as  contact  with  users  who  may  have  already 
become  aware  of  new  techniques  are  needed. 
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On  their  part,  users  may  want  to  avoid  a justification  of  their  requests,  where 
the  request  represents  an  unannounced  strategy,  an  experiment,  or  a status 
need  rather  than  a cost-justified  need. 

Users  may  be  demanding  the  right  to  be  responsible  for  all  aspects  of 
their  business  plans  and  feel  encumbered  by  EDP  "second  guessing"  or 
previous  bad  experiences. 

. Stronger  executive  management  or  a clearer  organization-based 
information  policy  must  give  direction  to  these  efforts, 
considering  both  the  problems  that  can  result  as  well  as  the 
opportunities  that  can  be  met  by  local  systems  development. 

None  of  the  steps  that  has  been  suggested  may  succeed.  EDP  management 
may  have  to  accept  a compromise  in  organizational  strength  or  controls  as  a 
result  of  management  policy  decisions. 

The  objective  of  EDP  management  should  be  to  have  the  widest  span  of 
influence  possible  in  regard  to  user-operated  systems  and  equipment,  even  if 
control  is  not  being  exercised  directly  by  a steering  committee  or  top 
management. 

EDP  management  should  be  recognized  as  the  spokesman  for  the 
effective  use  of  computing. 

The  development  of  a workable  control  process  assists  EDP  to  achieve  this 
higher  objective,  even  though  it  may  appear  to  be  giving  up  something  (i.e., 
the  operation  and  development  of  EDP  systems). 

Line  management  should  also  be  prepared  for  and  encourage  the  introduction 
of  a control  process  since  it  produces  rapprochement  between  end  users  and 
EDP,  and  furthers  the  overall  information  objectives  of  the  organization. 
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Where  EDP  management  cannot  convince  higher  levels  of  management  or 
users  that  a control  process  should  be  introduced,  a strategy  should  be 
developed  to  aid  users  as  much  as  possible  to  meet  their  computing  objectives 
in  those  activities  brought  to  the  attention  of  the  EDP  organization. 

The  strategy  should  bring  the  following  elements  to  the  attention  of  users: 

Methods  of  defining  and  ranking  needs. 

Methods  of  performing  a feasibility  analysis  to  determine  whether 
applications  are  justified. 

Steps  or  phases  in  analyzing  and  developing  a system. 

Recognition  of  corporate  accounting  and  other  conventions. 

Languages,  software  packages,  and  techniques  that  can  make  develop- 
ment easier. 

Limitations  in  equipment  and  vendor  services  that  could  prevent  data 
communication,  the  portability  of  data  or  applications,  successful 
operation  of  a system,  growth  or  movement  to  more  powerful  systems, 
etc. 

These  elements  should  be  brought  to  user  attention  through  the  best  organiza- 
tional or  marketing  approaches  possible.  Newsletters,  seminars,  outside 
education,  and  other  avenues  can  be  explored. 

The  need  for  organizational  changes  to  strengthen  EDP  management  in  its 
quest  for  improved  services,  methods,  and  development  of  staff  capabilities 
should  not  be  overlooked. 

Recommendations  for  an  effective  control  process  are  summarized  below: 
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The  control  process  should  be  an  ongoing  review  that  involves  coopera- 
tive work  between  users  and  EDP  staff  under  corporate  overview. 

The  process  is  best  initiated  with  the  participation  of  corporate 
management. 

A strategy  or  mission  statement  should  be  developed  to  support  the 
control  process,  but  possibly  after  the  process  has  started  in  order  to 
reflect  problems  or  adjustments  encountered  in  the  learning  phase. 

The  control  process  has  to  encompass  a combination  of  budgetary  and 
financial  controls,  as  well  as  other  techniques  of  guidance  and  review. 
All  needs  for  computing,  and  plans  to  satisfy  them,  should  be  docu- 
mented and  subject  to  technical  review. 

Plans  (including  forecasts  of  needs)  should  be  prepared  with  the  aid  of 
the  EDP  staff  to  the  extent  possible. 

Formal  reviews  of  specific  items  might  be  held  only  where  there  are 
disagreements  about  the  benefits,  priorities,  solutions,  resources  to  be 
utilized,  costs,  etc.,  which  cannot  be  resolved,  or  when  the  costs 
involved  exceed  a substantial,  predefined  threshold. 

When  the  EDP  department  cannot  meet  high  priority  user  needs  in  the 
time  required,  solutions  that  involve  user-operated  systems  and  equip- 
ment may  be  permitted  by  the  control  process.  The  selection  of 
hardware  and  software  vendors,  data  communication  techniques,  appli- 
cation languages,  etc.  should  be  constrained  to  a predetermined  set  of 
technically  acceptable  alternatives,  or  be  subject  to  review.  The 
objectives  of  EDP  management  should  be  to  exercise  a wide  sphere  of 
influence  and  advice,  even  if  direct  control  in  certain  user  areas  has  to 
be  compromised. 
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A "marketing"  or  consulting  attitude  on  the  part  of  EDP  staff  members 
is  a valuable  aid  to  the  control  process. 

The  user  department  may  sometimes  come  into  contact  with  new 
technology  or  techniques  which  should  be  fed  back  and  shared  with  the 
EDP  staff. 

The  control  process  should  be  adaptive  and  respond  to  changes  in 
technology  and  techniques  as  well  as  to  the  increasing  knowledge  level 
of  users. 

An  expansion  of  equipment  capabilities  can  provide  users  the  opportunity  to 
meet  their  needs  internally,  while  supporting  the  control  process  as  well.  Both 
DDP  and  internal  timesharing  routes  appear  meaningful,  but  both  could  be 
challenged  by  lower  cost,  perhaps  specialized,  minicomputers  or  large  micro- 
computers. EDP  management  should  be  prepared  for  new  trade-off  considera- 
tions. 
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Ill  USER-OPERATED  SYSTEMS  AND  EQUIPMENT 


Ill 


USER-OPERATED  SYSTEMS  AND  EQUIPMENT 


A.  SOURCES  FOR  EDP  SERVICES 


• A profile  of  the  sources  of  data  processing  capabilities  for  users  in  45 
companies  is  shown  in  Exhibit  lll-l.  These  data  were  obtained  from  the  study, 
Selling  Personal  Computers  to  Large  Companies,  published  by  INPUT  in 
September  1980. 


Departmental  systems  cited  in  this  exhibit  include  minicomputers  under 
the  control  either  of  a user  department  or  a decentralized  EDP  group. 
These  systems  may  be  connected  to  a network  and/or  form  part  of  a 
DDP  system. 

• User  respondents  to  the  study  had  been  contacted  directly  by  vendors  for 
external  computing  services,  minicomputers,  and  even  a few  larger  micro- 
computers (above  $15,000  in  cost). 


Users  had  been  able  to  order  computing  equipment  or  the  use  of 
services  below  certain  budget  levels  without  a review  from  EDP 
purchasing  or  another  office. 

Some  users  were  identified  who  called  their  computers  "statistical 
analyzers,"  "pipeline  controllers,"  etc.,  so  that  they  could  avoid  a 
review  of  computer  acquisitions. 
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EXHIBIT  MI-1 


SOURCES  OF  DATA  PROCESSING  SERVICES 
FOR  USERS  IN  FORTY-FIVE  COMPANIES* 


\7)  MANUFACTURING 
I | BANKING 
03  INSURANCE 

NOTE:  TOTALS  MAY  BE  GREATER  THAN  100%  DUE  TO  MULTIPLE  SOURCES  OF  SERVICE 
* TAKEN  FROM  1980  INPUT  STUDY  PERSONAL  COMPUTERS  IN  LARGE  COMPANIES 
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Vendors  of  remote  computing  services  were  also  willing  to  provide 
service  under  various  names  to  avoid  review. 

These  data  confirm  and  extend  the  evidence  for  a phenomenon  INPUT  termed 
"leakage"  earlier  this  year  in  the  report  entitled  Changing  Economics  in  the 
Information  Organization. 

Although  INPUT  believes  (and  recommends)  that  most  organizations  attempt 
to  control,  or  at  least  direct,  information-related  expenditures  for  the  benefit 
of  the  total  organization,  it  is  apparent  that  these  efforts  are  not  entirely 
successful. 

Three  companies  among  30  respondents  contacted  for  this  study  have  not  tried 
to  keep  track  of  user  operated  systems  and  equipment.  (Two  of  these 
companies  are  in  the  Fortune  100.) 

The  other  27  respondents  used  the  techniques  listed  in  Exhibit  111-2  to  stay 
aware  of  user-operated  systems  and  equipment.  When  user  activities  at  their 
companies  were  mentioned  during  an  interview,  two  of  the  respondents  to  this 
survey  added  the  items  mentioned  by  the  interviewer  to  lists  of  user  activities 
which  they  had  previously  compiled. 

Yet,  most  respondents  (26  out  of  30)  could  not  readily  provide  an  estimate  of 
the  total  expenditures  for  user  operated  systems,  as  shown  in  Exhibit  1 1 1-3. 

Some  user  expenditures  are  included  in  the  EDP  budget,  but  may  or  may 
not  be  billed  back  to  users,  either  with  or  without  allocations  or  other 
costs  added. 

Most  user  expenditures  for  computing  are  not  classified  as  such. 

When  EDP  management  prepares  aggregations  of  computing,  external 
service,  data  and  voice  communication  costs  for  different  purposes, 
expenditures  for  user-run  systems  alone  are  not  readily  available. 
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EXHIBIT  1 1 1-2 


HOW  EDP  MANAGEMENT 
TRACKS  USER  ACTIVITIES 
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EXHIBIT  111-3 


ABILITY  TO  AGGREGATE 
USER  EXPENDITURES 


- 21  - 

©1981  by  INPUT.  Reproduction  Prohibited. 


INPUT 

UCUER 


• Further  questioning  of  respondents,  combined  with  vendor-supplied  data, 
produced  the  agreed  upon  estimates  of  the  expenditures  for  user  activities 
compared  to  the  budgets  of  the  EDP  departments,  at  the  respondents' 
companies,  as  listed  in  Exhibit  1 1 1-4. 


B.  CLASSIFICATIONS  OF  USER-OPERATED  SYSTEMS  AND  EQUIPMENT 


• Information  on  the  departments  where  user-operated  systems  and  equipment 
might  be  found  is  shown  in  the  bottom  five  rows  of  Exhibit  111-5,  which  was 
obtained  from  the  1980  research  study  on  45  users  noted  in  Exhibit  lll-l. 

• Among  30  respondents  and  separate  contacts  made  during  the  current  study, 
the  following  classes  of  user  operated  systems  and  equipment  were  formed: 

Terminals  and  remote  job  entry  stations  (RJE)  connected  to  external 
timesharing  and  remote  services  companies. 

Internal  timesharing  systems  that  are  provided  to  users  at,  or  slightly 
above,  actual  cost,  and  offer  such  aid  and  flexibility  that  they  are 
perceived  as  a vehicle  for  user-run  systems. 

. For  instance,  some  companies  encourage  users  to  acquire  word 
processing  systems  or  micros  with  communication  features  so 
that  they  can  connect  to  the  timesharing  system  and  use  existing 
files  and  data  bases. 

. Internal  timesharing  systems  that  are  the  only  permitted  time- 
sharing or  computer  capability  available  (other  than  the  central 
facilities)  are  not  generally  thought  of  as  user-run  systems. 

Minicomputers  solely  under  user  control,  either  standalone  or  connected 
to  networks. 
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EXHIBIT  111-4 


USER  EXPENDITURES  FOR  COMPUTING  COMPARED  TO 
BUDGET  OF  EDP  DEPARTMENT 
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DEPARTMENTS  OBTAINING  COMPUTING  SERVICES* 
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Dedicated  minicomputers  authorized  by  the  EDP  organization  for  users, 
whether  operated  on  a standalone  or  DDP  basis. 

. These  computers  may  appear  on  the  budget  of  either  the  user  or 
the  central  EDP  department.  The  computer  may  seem  to  be  only 
partially  under  user  control,  but  if  the  user  regards  it  as  his 
system,  it  has  been  classified  as  user-controlled. 

Micros  or  personal  computers  given  or  provided  economically  by 
corporate  or  EDP  management  to  users. 

. Four  companies  were  found  who  were  engaged  in  doing  this. 
Three  of  the  companies  had  provided  in  excess  of  50  units. 


Micros  bought  by  users  with  or  without  knowledge  of  EDP  or  corporate 
management. 

. Vendors  could  usually  identify  a substantial  number  of  installa- 
tions of  personal  computers  at  large  companies. 

Office  automation  as  well  as  word  processing  systems  being  used  to  run 
system  applications. 

. This  equipment  is  generally  under  the  control  of  and  on  the 
budget  of  the  user. 

Data,  voice,  and  image  communication  systems  being  designed  and 
installed  by  users. 


Several  of  these  classes  of  user  operated  systems  and  equipment  were  present 
at  all  companies  that  were  respondents  to  this  study.  Exhibit  1 1 1-6  lists  the 
types  that  were  mentioned  by  these  respondents. 
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EXHIBIT  1 1 1-6 


TYPES  OF  USER-OPERATED  SYSTEMS 


TYPE* 


TERMINALS  OR  RJE 
UNITS  CONNECTED  TO 
REMOTE  SERVICES 


COMPUTERS  CONNECTED 
TO  INTERNAL  NET- 
WORKS OR  INCLUDED  IN 
DDP  PLANS 


STANDALONE  MINIS 
AND  MICROS 


INTERNAL  TIME- 
SHARING 


0 20  40  60  80  100 

PERCENT  OF  RESPONDENTS 

* USERS  MAY  HAVE  MORE  THAN  ONE  TYPE 
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• Users  are  becoming  more  capable  of  developing  and  installing  application 
systems  and  of  operating  systems  on  their  own  computing  equipment,  as 
Exhibit  1 1 1-7  indicates. 

However,  they  are  quite  likely  to  have  aid  from  vendors  and  consultants 
in  developing  and  installing  applications. 

Although  vendors  and  consultants  have  sometimes  created  problems  for 
users  and  the  EDP  organization,  EDP  management  seemed  less  prone  to 
worry  about  the  work  of  vendors  versus  that  of  users,  since  vendors 
would  generally  follow  some  set  of  standards. 

• EDP  management  varied  in  its  authority  to  require  vendors  to  follow  internal 
corporate  standards  and  guidelines,  including  the  choice  of  equipment  and 
programming  language. 

In  some  cases,  EDP  management  had  project  control  responsibility  over 
vendor  work  for  users. 

Some  were  found  who  had  applications  being  developed,  installed  and 
run  by  more  than  one  source  at  a given  time,  complicating  the  tasks  of 
project  management  and  coordination. 


C.  USER-PERCEIVED  BENEFITS 


• Users  attribute  two  sets  of  benefits  to  their  systems  and  equipment,  as  shown 
in  Exhibit  1 1 1-8.  The  first  set  covers  the  traditional  benefits  which  EDP 
departments  use  for  justification.  These  benefits  and  the  percent  of 
respondents  mentioning  them  are  shown  on  the  left  half  of  the  exhibit.  The 
right  half  shows  other  benefits  which  motivate  users  to  operate  their  own 
systems  and  equipment. 
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EXHIBIT  MI-7 


PROVIDERS  OF  AID  FOR  USERS  TO  DEVELOP,  INSTALL, 
AND  OPERATE  SYSTEMS 


RESOURCE 


EDP  STAFF 


VENDORS  OF 
HARDWARE  AND 
SOFTWARE 


RCS  VENDORS 


USER'S  OWN 
RESOURCES 


DEVELOPMENT  AID 


USING  RESOURCE 


ill  INSTALLATION  AID 


OPERATIONS  AID 
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BENEFITS  ATTRIBUTED  BY  USERS  TO  THEIR  SYSTEMS 


TRADITIONAL  BENEFITS 

PERCENT 

OF 

RESPON- 

DENTS 

OTHER  BENEFITS 

PERCENT 

OF 

RESPON- 

DENTS 

COST  SAVINGS 

87% 

DID  NOT  WAIT  FOR 
ASSISTANCE  FROM 
EDP 

80% 

REVENUE  IMPROVEMENT 

87 

RAPID  DEVELOPMENT 

80 

SUPPORT  OF  BUSINESS 
FUNCTIONS 

50 

SYSTEM  EASILY 
MODIFIED 

63 

CONTROL 

33 

MORE  ECONOMIC  THAN 
EDP  DEPARTMENT 

50 

OTHER  BUSINESS 
REASONS 

3 

MORE  FLEXIBLE  OPER- 
ATING ENVIRONMENT 

40 

SYSTEM  DEVELOPED 
WITH  MORE  QUALITY 
OR  CAPABILITY 

15 
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• The  traditional  benefits  are  more  apt  to  be  reviewed  or  audited,  although  EDP 
management  and  users  agree  in  most  cases  that  these  benefits  did  not  provide 
sufficient  reason  to  act. 

• EDP  departments  may  agree  that  the  queue  of  work  to  be  done,  or  personnel 
shortages,  make  it  valid  for  users  to  act  more  quickly,  but  a review  or  audit  of 
the  need  to  act  rapidly  is  not  generally  conducted. 

• Exhibit  1 1 1-8  also  reveals  that  a few  users  mention  better  quality  or  capability 
as  a benefit. 

The  INPUT  study,  Improving  the  Productivity  of  Systems  and  Software 
Implementation,  demonstrated  that  a concern  with  quality  is  one  of  the 
characteristic  stages  of  increasing  productivity,  leading  to  improved 
payback  on  the  use  of  EDP.  Users  who  cite  improved  quality  as  a 
benefit  of  having  their  own  systems  may  indicate  that  their  thinking 
and  experience  with  computing  may  be  more  mature  than  that  of  the 
EDP  organization  itself. 


D.  PROBLEMS  ENCOUNTERED 


• The  fewest  problems  were  mentioned  by  those  respondents  who  have  strong 
controls. 

Users  at  such  companies  may  still  feel  that  they  cannot  obtain  service 
or  have  work  done,  but  simply  did  not  mention  it.  Consequently,  the 
absence  of  problems  may  not  be  an  adequate  indication  of  the  effective 
use  of  data  processing. 
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• The  most  problems,  on  the  other  hand,  were  mentioned  both  by  users  and  EDP 
management  of  the  eight  respondents  who  had  no  controls  covering  user- 
operated systems  and  equipment  (as  shown  in  Exhibit  ll-l),  and  particularly  by 
the  three  respondents  who  did  not  track  EDP  expenditures  by  users  at  all. 

• The  middle  group,  comprising  organizations  who  had  recently  strengthened  or 
are  now  implementing  controls,  cited  the  occurrence  of  problems  as  a reason 
for  strengthening  controls. 

• Other  than  by  the  subjective  evaluation  of  the  respondent,  it  was  impossible  to 
relate  levels  of  problems  to  intrinsic  technical  factors  of  user  systems. 
However,  the  litany  of  problems  shown  in  Exhibit  1 1 1-9  and  the  reaction  of 
respondents  to  each  problem  are  indicative  of  the  difficulties  that  user 
operated  systems  and  equipment  encounter. 

E.  EMERGING  METHODS  OF  CONTROL 


• The  growth  of  user-operated  systems  and  equipment,  and  the  problems 
accompanying  them,  has  led  to  an  increase  in  the  methods  of  control  and 
guidance  for  user  activities  at  I 2 of  the  30  respondents'  companies. 

• Most  respondents  from  the  companies  who  reported  that  they  were  relying  on 
present  controls  did,  however,  indicate  increased  efforts  to  enforce  those 
controls  or  supplement  them  with  other  services. 

• A summary  of  the  types  of  controls  implemented  or  increased  is  shown  in 
Exhibit  III- 10. 

• INPUT  notes  that  one  of  the  most  effective  methods  of  control;  i.e., 
management  of  the  corporate  data  base,  was  not  mentioned  by  any  of  the 
respondents  to  this  study. 
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EXHIBIT  MI-9 


PROBLEMS  ENCOUNTERED  WITH  USER- 
OPERATED SYSTEMS  AND  EQUIPMENT 


PROBLEM 

PROBLEM 

INDEX* 

USER  NEEDS  WERE  NOT  MET 

32 

NETWORK  STRATEGY  WAS  NOT  SUPPORTED 

22 

USER  APPLICATIONS  COULD  NOT  BE  MOVED  TO 
SERVE  OTHER  USERS  OR  TO  LOAD  SHARE 

21 

SOFTWARE  PROBLEMS  WERE  ENCOUNTERED 

18 

OPERATING  PROBLEMS  WERE  ENCOUNTERED 

17 

CORPORATE  ACCOUNTING  AND  OTHER  CONVENTIONS 
WERE  NOT  FOLLOWED 

16 

EQUIPMENT  PERFORMANCE  WAS  POOR 

15 

USERS  BECAME  A BURDEN  TO  EDP 

12 

AVAILABLE  SOFTWARE  PACKAGES  SUCH  AS  DBMS 
COULD  NOT  BE  USED 

9 

DATA  INCONSISTENCIES 

5 

MISCELLANEOUS  OTHER 

10 

* INDEX  CONSTRUCTED  BY  SUMMING  WEIGHTED  RESPONSES  FROM  RESPONDENTS. 

HIGH  MAGNITUDE  PROBLEMS  = 3 
MEDIUM  MAGNITUDE  PROBLEMS  = 2 
LOW  MAGNITUDE  PROBLEMS  = 1 
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EXHIBIT  111-10 


CONTROLS  IMPOSED  OR  INCREASED  FOR 
USER-OPERATED  SYSTEMS  AND  EQUIPMENT 


CONTROL  METHOD 

PERCENT  OF 
RESPONDENTS 
WHO  IMPOSED 
OR  INCREASED 
CONTROL 

STANDARDS  FOR  ACCOUNTING  CONVENTIONS 

75% 

STANDARDS  FOR  DATA  COMMUNICATIONS 

67 

STANDARDS  FOR  EQUIPMENT 

58 

CONTROLS  THAT  REQUIRE  REPORTING  OF  ALL 
COMPUTING  EXPENDITURES 

58 

TECHNIQUES  CONTROLLI NG /GU 1 Dl NC  USERS 
THROUGH  CONSULTATION 

58 

CONTROLS  ON  THE  LEVEL  OF  COMPUTING 
EXPENDITURES  THAT  COULD  BE  OBTAINED 
WITHOUT  REPORTING 

50 

TECHNIQUES  REQUIRING  THE  APPROVAL  OF  ALL 
COMPUTING  RELATED  EXPENDITURES  BY  THE  EDP 
DEPT.,  A COUNCIL,  OR  EDP  STEERING  COMMITTEE 

50 

STANDARDS  FOR  SOFTWARE 

42 

STANDARDS  FOR  DEVELOPMENT,  IMPLEMENTATION, 
TESTING,  ETC.  OF  APPLICATIONS 

42 

TECHNIQUES  GUIDING  USERS  THROUGH  AUDITS 
OF  THE  BUDGETS,  PLANS,  AND  ACTIVITIES 
RELATED  TO  EDP 

33 
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This  observation  accords  with  the  findings  of  the  study,  Improving  the 
Productivity  of  Systems  and  Software  Implementation,  that  fewer  than 
1%  of  all  EDP  organizations  have  reached  the  fourth  stage  of  produc- 
tivity. 

The  fourth  stage  is  characterized  by  independent  user  access  to  a 
centrally  controlled  data  base  (along  with  a number  of  other  produc- 
tivity factors). 

However,  INPUT  does  not  dispute  the  value  of  those  controls  that  were 
reported,  insofar  as  their  scope  of  effectiveness  is  concerned. 


) 
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IV  REVIEW  OF  CONTROLS 


IV  REVIEW  OF  CONTROLS 


000141 


A.  WHO  INTRODUCES  CONTROLS,  AND  WHY? 

• EDP  and  corporate  management  are  involved  more  often  than  users  in  the 

decision  to  impose  or  increase  controls,  as  shown  in  Exhibit  IV- 1. 

• The  users'  role  should  not  be  discounted,  however.  Half  the  respondents 

reported  user  involvement  in  the  decision  to  impose  controls,  and  more  users 
than  any  other  group  were  involved  in  the  crucial  role  of  auditing  benefits. 

• Although  the  concern  is  that  users  will  not  be  conservative  in  regard  to 

justifying  their  need  for  computing  capabilities,  comments  by  75%  of 
respondents  who  had  imposed  or  increased  controls  on  user-operated  systems 
and  equipment  showed  that  the  simple  existence  of  justification  procedures 
and  the  review  of  benefits  mandated  by  the  control  process  promoted  a 
satisfactory  level  of  compliance. 

• Responses  from  EDP  management  emphasized  that  providing  a role  for  users 
in  the  control  process  established  a feeling  of  ownership  which  resulted  in  a 
closer  user  review  of  requests. 

• EDP  management  clearly  has  a strong  role  in  introducing  and  enforcing 
controls,  as  shown  in  Exhibit  IV- 1 . The  EDP  department  is  generally  involved 
in  the  documentation  of  controls  as  well. 
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EXHIBIT  IV-1 


ORGANIZATION  ROLES 
IN  RELATION  TO  CONTROLS 


ORGANIZATION 

ELEMENT 


PERCENT  INVOLVED 
IN  ROLES 


USERS 


EDP 

MANAGEMENT 


HIGHER 

MANAGEMENT 


PERCENT  INVOLVED 
IN  ROLES 


□ 

rm 


±6*2. 

/ / / 

Lr./ J 


DECISION  TO  IMPOSE  CONTROLS 
INTRODUCTION  OF  CONTROLS 

ENFORCEMENT  OF  CONTROLS 
AUDIT  OF  USER  BENEFITS 
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• Corporate  management  is  involved  heavily  in  both  the  decision  to  impose 
controls  and  the  introduction  of  controls,  and  assists  in  the  enforcement  at 
over  half  of  the  respondent  organizations. 

• Top  management's  involvement,  however,  appears  to  have  been  frequently  a 
reaction  to  a prior  bad  experience,  rather  than  a positive  leading  step  to 
facilitate  effective  user  access  to  computing.  The  following  hypothetical 
dialogue  illustrates  the  contention  that  frequently  exists  between  user  and 
EDP  management,  which  top  management  must  resolve: 

User  statements: 

. "We  should  have  certain  EDP  needs  recognized  and  met  so  that 
we  can  meet  our  business  objectives." 

. "We  should  have  more  control  over  resources  that  are  used 
primarily  to  serve  local  needs." 

. "We  should  be  given  a good  explanation  for  EDP  costs  allocated 
to  us.  (Why  should  we  pay  more  for  an  internal  resource?)" 

EDP  management  statements: 

. "Users  should  not  expect  and  or  be  given  resources  for  needs  that 
cannot  be  defined  or  justified." 

. "Users  should  not  implement  solutions  that  are  technically 

unwise  or  not  cost  effective." 

. "Users  must  take  more  responsibility  for  requested  EDP 

activities." 
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. "Plans  that  will  significantly  increase  the  corporate  information 
processing  capabilities  should  have  priority  over  certain  local 
user  applications." 

• Where  this  contention  exists,  top  management  has  been  successful  in  introduc- 
ing a control  policy  to  alleviate  the  contention  and  bring  users  and  EDP 
together  in  a more  productive  framework. 

A longer  range  view  takes  the  position  that  top  management  ought  to 
lessen  contention  but  not  end  it,  since  contention  can  aid  results.  EDP 
management  will  scrutinize  user  needs  to  make  sure  business  objectives 
are  served  and  users  will  make  sure  EDP  management  does  not  commit 
resources  unnecessarily  for  upgrades  of  technological  capability. 

• In  either  case,  EDP  management  needs  to  maintain  a dialogue  with  users 
where  contention  for  resources  is  present.  Simply  knowing  what  users  are 
planning  may  help  to  prevent  future  incompatibilities. 

• Comments  made  by  the  12  respondents  who  had  imposed  or  strengthened 
controls  suggest  that  controls  were  first  thought  of  in  reaction  to  the  problems 
encountered  with  user-run  systems  and  equipment.  Two-thirds  of  the 
respondents  mentioned  problem  avoidance  as  a reason  for  increased  controls, 
together  with  the  other  objectives  shown  in  Exhibit  IV-2. 


B.  EFFECTIVENESS  OF  CONTROLS 


• Two-thirds  of  the  respondents  thought  that  increased  controls  achieved  a 
success  that  could  be  called  entirely  or  mostly  acceptable,  as  shown  in  Exhibit 
IV-3.  No  respondent  thought  that  controls  were  a failure  or  counter- 
productive. 
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EXHIBIT  I V-2 


WHAT  OBJECTIVES  CONTROLS  ARE  SUPPOSED  TO  ACHIEVE 


OBJECTIVES 

NUMBER  OF 
RESPONDENTS 

MENTIONED 
AS  THE 

PRECURSOR  OF 
CONTROLS 

SERVE  BUSINESS  STRATEGIES 

11 

NO 

SERVE  EDP  STRATEGIES 

10 

NO 

AVOID  PROBLEMS 

8 

YES 

AID  USERS 

6 

YES 

REDUCE  COSTS 

2 

YES 

REDUCE  DUPLICATE  COSTS 

1 

YES 

MAKE  SENIOR  MANAGEMENT 
AWARE  OF  GOALS 

1 

NO 

HAVE  USERS  TAKE  OWNERSHIP 
OF  ACTIONS 

1 

NO 
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EXHIBIT  IV- 3 


SUCCESS  OF  CONTROLS  IN  ACHIEVING  OBJECTIVES 
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One  company  without  controls  had  twice  failed  to  install  controls 
successfully,  but  the  respondent  from  this  company  noted  that  a new 
effort  would  be  made  since  the  objectives  to  be  attained  warranted  it. 

Comments  from  respondents  indicated  that  both  users  and  EDP  management 
were  willing  to  accept  limitations  in  order  to  achieve  the  objectives  of  the 
control  program.  The  most  vehement  contrary  response  was  from  the  member 
of  an  EDP  staff  who  thought  data  base  activities  would  be  delayed  for  up  to 
two  years  by  the  need  to  review  work  with  users  (although  EDP  management 
had  agreed  to  do  it). 

Exhibit  IV-4  indicates  the  methods  that  were  available  to  "measure"  effective- 
ness. (Comments  on  the  success  of  controls  seemed  to  be  based  entirely  on 
the  subjective  reactions  of  respondents  rather  than  on  using  these  methods, 
however.) 

In  discussions  with  respondents,  comments  were  made  that  controls  and/or  a 
process  were  needed  to: 

Make  users  review  their  needs  and  set  priorities  based  upon  business 
reasons. 

Allocate  available  EDP  department  resources  to  meet  needs. 

Select  vehicles  for  meeting  the  remaining,  qualified  user  needs. 

Control  the  use  of  EDP  in  a cost  effective  manner. 

The  above  comments  sound  more  like  the  basic  set  of  controls  for  the  use  of 
central  computing,  rather  than  an  increased  set  of  controls  to  guide  user 
activities.  Five  respondents  who  were  contacted  to  review  this  point 
confirmed  that  this  observation  was  true  for  their  companies. 
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EXHIBIT  I V-4 


TECHNIQUES  USED  FOR 

MEASURING  THE  EFFECTIVENESS  OF  CONTROLS 


PERCENT  OF  RESPONDENTS 


*MORE  THAN  ONE  METHOD  MAY  BE  USED. 
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The  respondents  felt  that  EDP  management  at  these  organizations 
should  have  been  trying  to  communicate  these  objectives  before  the 
succession  of  user-run  systems,  problems,  and  controls  took  place. 

Where  these  objectives  cannot  be  communicated,  top  management- 
imposed  controls  for  user  systems  and  equipment  can  force  the  issue, 
but  sometimes  to  the  detriment  of  the  central  EDP  organization. 

Respondents  rated  the  relative  effectiveness  of  various  control  methods,  as 
shown  in  the  top  half  of  Exhibit  IV-5.  (The  specific  items  that  compose  each 
method  were  listed  in  Exhibit  III- 10.) 

A more  interesting  indication  of  effectiveness  is  shown  in  the  bottom  half  of 
Exhibit  IV-5,  which  portrays  how  effective  individual  categories  of  controls 
were  thought  to  be  by  the  respondents  who  achieved  the  greatest  success  with 
controls. 

Budget  and  financial  controls,  which  assure  the  visibility  of  all  relevant 
expenditures  and  provide  the  opportunity  to  review  expenditures,  were  thought 
to  be  most  effective  in  controlling  user  systems  and  equipment. 

However,  respondents  commented  that  budget  controls  should  be 
supplemented  with  other  services  of  the  EDP  staff. 

One  respondent  without  controls  had  failed  in  two  attempts  to  introduce 
budgeting  controls.  This  company  plans  to  introduce  budget  controls  again, 
together  with  consulting  aid  to  users,  an  EDP  mission  statement,  and  more  of 
an  EDP  marketing  attitude  toward  users. 

Technical  standards  were  viewed  as  a less  effective  control,  and  EDP 
management  seemed  satisfied  to  wait  to  promote  standards  until  after  a 
budget  control  process  was  established.  However,  several  respondents  were 
willing  to  have  users  observe  general  standards  or  any  standards  as  a first  step. 
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EXHIBIT  IV-5 


EFFECTIVENESS  OF 


CONTROL  METHODS 


CONTROL  METHOD 

PERCENT  OF  RESPON- 
DENTS RATING  EACH 
METHOD  AS* 

HIGH 

MEDIUM 

LOW 

TECHNICAL  STANDARDS 

25% 

33% 

8% 

BUDGETS/FINANCIAL 

REVIEWS 

75 

17 

8 

OTHER  TECHNIQUES 

58 

17 

8 

♦DIFFERENCE  BETWEEN  100%  AND  ROW  TOTALS  DUE  TO  "NO  ANSWER"  OR 
"NOT  USED" 


ACHIEVEMENT  OF  OBJECTIVES  VERSUS 
RATING  OF  CONTROL  METHOD 


WHERE  OBJECTIVES 
WERE  OBTAINED 

- 

CONTROL  METHODS  RATED 
AS  HIGH  IN  EFFECTIVENESS 

. 

ENTIRELY 

BUDGET/FINANCIAL  REVIEW  -100% 
OTHER  TECHNIQUES  - 75% 
TECHNICAL  STANDARDS  - 8% 

MOSTLY 

BUDGET/ FINANCIAL  REVIEWS  - 100% 
OTHER  TECHNIQUES  - 100% 
TECHNICAL  STANDARDS  - 67% 

PARTIALLY 

NONE  RATED  HIGH 
BUDGET  AND  FINANCIAL  REVIEWS 
WERE  RATED  MEDIUM  BY  100% 

SOMEWHAT 

NONE  RATED  HIGH  OR  MEDIUM 
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Internal  timesharing  or  DDP  standards  were  often  the  first  ones  introduced. 


C.  IMPROVEMENT  ATTRIBUTED  TO  CONTROLS 


• Two-thirds  of  the  respondents  listed  problem  avoidance  as  an  objective  of 
increased  controls,  as  shown  in  Exhibit  IV-6.  However,  other  reasons  were 
mentioned  more  often.  Of  the  total  count  of  reasons,  problem  avoidance 
accounted  for  only  20%  of  responses. 

The  exhibit  also  shows  that  problem  avoidance  was  identified  as  one  of 
the  two  most  important  objectives  by  only  13%  of  respondents  who  had 
increased  controls. 

• In  fact,  problem  avoidance  diminishes  in  importance  as  soon  as  there  begin  to 
be  discussions  about  the  introduction  of  controls. 

Comments  from  user  and  EDP  personnel  suggest  that  the  control 
process  itself,  by  bringing  users  and  EDP  together  to  address  problems, 
cannot  help  but  alleviate  outstanding  problems. 

Exhibit  IV-7  illustrates  the  types  of  improvement  respondents  reported. 

• Even  when  users  obtain  equipment  and  run  their  own  systems,  EDP  manage- 
ment should  remain  in  contact  with  them  to  provide  aid,  promote  standards, 
and  enlarge  a sphere  of  influence. 

• Users  reported  benefits  from  controls,  as  shown  in  Exhibit  IV-8.  Forty-two 
percent  noted  a definite  increase  in  the  ability  to  meet  their  needs,  and  every 
respondent  indicated  that  there  was  at  least  a possible  increase  in  this  ability. 

All  respondents  felt  that  there  was  improvement  in  the  selection  of 
hardware  and  software  for  user  systems. 
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EXHIBIT  IV-6 


PROBLEM  AVOIDANCE  IN  PERSPECTIVE 


OBJECTIVE 

SERVE  BUSINESS 
STRATEGIES 

SUPPORT  EDP 
STRATEGIES 

AVOID  PROBLEMS 
AID  USERS 

OTHER  OBJECTIVES 
REDUCE  COSTS 

0 20  40  60  80  100 


V/////////////////Z7I 
ZZZZZZZZZZZZZZZZZZ3  33 


91 


Yzzzzzzzzzzzzn  ^ 


V 


7ZZZZZZZZZZ  5° 


zzzzzi  25 


17 


I J l 


J L 


PERCENT  OF  RESPONDENTS 
STATING  OBJECTIVE 


£ OTHER  jH 
? OBJECTIVES^ 

£ 80%  5 - 


PROBLEM 

AVOIDANCE 

20% 


PROBLEM  AVOIDANCE 
VERSUS  OTHER  OBJECTIVES 


PROBLEM  AVOIDANCE  AS  A 
PERCENT  OF  MOST  IMPORTANT 
OBJECTIVES  (THOSE  RANKED  FIRST 
OR  SECOND  BY  RESPONDENTS) 


I-  MOST  -j 
* IMPORTANT  * 
OBJECTIVES  £ 
87%  1 


PROBLEM 

AVOIDANCE 

13% 
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EXHIBIT  I V-7 


PROBLEMS  ALLEVIATED  THROUGH  CONTROLS 


PROBLEMS  MENTIONED 
MOST  OFTEN 

PERCENT  OF  RESPONDENTS 
NOTING  IMPROVEMENT 
THROUGH  INCREASED  CONTROL5 

USER  NEEDS  NOT  MET 

1 00%  EXPER IENCED  SOME 
IMPROVEMENT 

42%  HAD  A DEFINITE  RESULT 
58%  HAD  LIMITED  GAINS 

CORPORATE  ACCOUNTING 
AND  OTHER  CONVENTIONS 
NOT  FOLLOWED 

91%  NOTED  THAT  THE  QUALITY 
OF  SPECIFICATIONS  HAS 
IMPROVED 

EDP  NETWORK  STRATEGY 
NOT  SUPPORTED 

67%  EXPERIENCED  MORE 
SUPPORT 

USER  APPLICATIONS  COULD 
NOT  BE  MOVED  TO  LOAD 
SHARE  OR  SERVE  OTHER  USERS 

58%  FELT  THE  CAPABILITY  HAD 
BEEN  GAINED  AND  33%  HAD 
ACTUALLY  DONE  IT 

OPERATING  PROBLEMS 
ENCOUNTERED  IN  RUNNING 
JOBS 

91%  FELT  THE  OPERATION 
OF  USER  SYSTEMS  HAD 
IMPROVED  IN  QUALITY 

SOFTWARE  PROBLEMS 
ENCOUNTERED 

75%  FELT  THE  QUALITY  OF 
SOFTWARE  MAINTENANCE 
HAD  IMPROVED 
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EXHIBIT  IV-8 


INCREASED  USER  ABILITY  TO  MEET  NEEDS 


PERCENT  NOTING  IMPROVEMENT 
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Users  benefited  from  an  increased  ability  to  use  systems  developed  at  other 
sites.  Seven  of  12  respondents  noted  that  this  capability  now  existed,  and  four 
had  actually  done  it. 

The  necessity  to  impose  or  increase  controls  often  had  the  effect  of  clarifying 
the  circumstances  under  which  users  could  (and  should)  develop  their  own 
systems.  Therefore,  it  became  less  likely  for  users  to  try  to  get  around  a 
control  process  that  explicitly  recognized  their  needs. 

To  test  this  assumption,  users  at  five  responding  companies  that  had  not 
increased  controls,  and  at  four  responding  companies  that  had,  were  asked 
about  their  desire  to  get  around  or  subvert  controls. 

As  expected,  the  former  group  was  more  likely  to  subvert  controls  if 
they  could.  Several  users  in  these  organizations  had  obtained 
computers  or  services  that  had  not  been  reported  to  the  EDP  depart- 
ment. 

Nine  of  the  12  respondents  who  had  increased  controls  noted  that  this  change 
had  resulted  in  steps  to  address  user  applications  which  supported  long-range 
EDP  plans. 

A list  of  other  improvements  in  the  use  of  computing  attributed  to 
increased  controls  is  shown  in  Exhibit  IV-9. 

The  control  process  helps,  encourages,  or  forces  users  to  evaluate  their  needs 
and  plans  through  review  meetings  and/or  paperwork  with  the  EDP  organiza- 
tion or  a related  committee  (steering,  MIS,  etc.).  This  process  improves 
familiarity  and  lessens  the  feeling  of  contention  that  might  otherwise  exist 
between  users  and  the  EDP  organization. 

As  noted,  the  control  process  improves  the  selection  of  projects  and  the  use  of 
computing  to  meet  corporate  and  user  objectives,  whether  central  EDP  or  user 
resources  are  utilized.  This  supports  the  mission  of  the  EDP  organization. 
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EXHIBIT  1 V-9 


IMPROVEMENTS  IN  THE  USE  OF  COMPUTING 


IMPROVEMENT 

NUMBER  OF 
RESPONDENTS  WITH 
THIS  IMPROVEMENT 

DEFI- 

NITELY 

SOME- 

WHAT 

POS- 

SIBLY 

EVALUATION  OF  HARDWARE 

12 

— 

— 

EVALUATION  OF  SOFTWARE 

12 

— 

— 

QUALITY  OF  CONVERSION 

11 

— 

— 

QUALITY  OF  DOCUMENTATION 

11 

— 

— 

QUALITY  OF  ENHANCEMENT  PROCEDURES 

11 

— 

— 

QUALITY  OF  OPERATION  OF  SYSTEM 

11 

— 

— 

QUALITY  OF  PROGRAMMING 

11 



— 

QUALITY  OF  SPECIFICATIONS 

11 

— 

— 

QUALITY  OF  SYSTEM  DESIGN 

11 

— 

— 

QUALITY  OF  TESTING 

11 

— 

— 

QUALITY  OF  MAINTENANCE  OF  SOFTWARE 

9 

— 

— 

SUPPORT  OF  NETWORK  OR  DDP  STRATEGY 

8 

3 

— 

INCREASED  USE  OF  SOFTWARE  PACKAGES 
SUCH  AS  FINANCIAL  MODELING  OR  DBMS 

4 

— 

2 

INCREASED  USE  OF  PRODUCTIVITY  AIDS 

3 

— 

— 

IMPROVEMENT  IN  EQUIPMENT  MAINTENANCE 

1 

— 

— 
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• The  perception  of  the  role  of  the  EDP  organization  shows  a marked  change 
when  controls  are  introduced,  as  shown  in  Exhibit  IV- 10. 

The  characterizations  of  the  EDP  department  as  "cumbersome"  or  "too 
busy"  were  not  mentioned  after  controls  were  introduced. 

• After  controls,  there  is  significantly  more  involvement  of  end  users  in  the 
centralized  development  of  systems  as  well. 

• From  a management  perspective,  the  control  process  focuses  more  attention 
on  meeting  the  business  objectives  of  the  firm.  Seventy-five  percent  of 
respondents  noted  that  controls  resulted  in  the  selection  of  user  applications 
which  supported  business  objectives. 

• Management  in  some  cases  felt  that  controls  encouraged  users  to  become  less 
involved  in  routine  computing  jobs  and  more  in  their  own  jobs. 

• Users  were  more  apt  to  utilize  efficient  techniques  to  meet  their  needs,  such 
as  higher  level  languages,  application  packages,  and  better  development 
techniques. 

• The  control  process  provided  better  documentation  of  business  needs, 
priorities,  resources  used,  costs,  etc. 

D.  OTHER  FACTORS 


• The  development  of  a strategy  for  imposing  controls  was  undertaken  by  two- 
thirds  of  the  respondents.  Only  two  developed  a statement  before  controls 
were  introduced.  The  others  did  it  during  the  period  controls  were  introduced. 

• A strategy  or  mission  statement  establishes  the  reasons  and  objectives  for 
control  or  guidance.  It  usually  establishes  the  fact  that  the  controls  are 
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EXHIBIT  IV-10 


PERCEPTION  OF  THE  CENTRAL  EDP  STAFF  BY  USERS 


BEFORE 

CONTROLS 

AFTER  CONTROLS 

NUMBER  OF 

NUMBER  OF 

DESCRIPTION 

RESPONDENTS 

DESCRIPTION 

RESPONDENTS 

CUMBERSOME 

4 

PARTICIPATION  IN 

a 

USER  ACTIVITY 

0 

TOO  BUSY 

6 

ASSISTANCE  WITH 

11 

HELPFUL 

11 

CONTROLS 

TOTALLY  IN- 

HELP  IN  CONTROL- 

r 

VOLVED  WITH 

2 

LING  VENDORS 

D 

USER 

EDUCATING  USERS 

7 

ONLY  IN  FAVOR 

OF  A CENTRAL 

1 

CONSULTING 

11 

SOLUTION 

WITH  USERS 

HELPFUL 

c 

ATTITUDE 

D 

NOT  FULLY 

1 

INVOLVED 
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concerned  with  utilizing  EDP  effectively  for  the  corporation  and  not  simply 
for  controlling  or  limiting  users. 

This  creates  a positive  climate  for  the  use  of  controls. 

It  also  establishes  the  premise  that  this  is  why  controls  or  guidance 
were  established. 

It  could  also  be  used  as  part  of  a presentation  to  users  or  management 
to  support  the  review  and  guidance  of  user  plans  under  existing 
procedures. 

• A marketing  attitude  by  EDP  representatives  was  mentioned  as  a factor  in  the 
introduction  of  controls  by  half  the  respondents.  Comments  by  other 
respondents  also  indicated  that  a positive,  helpful  attitude  was  a necessary  one 
for  EDP  to  adopt  during  the  introduction  of  controls. 

• Respondents  also  noted  that  the  EDP  staff  may  have  to  increase  its  knowledge 
of  new  technology  to  aid  users  who  are  learning  about  computing  development 
from  leading  companies  in  their  industry  or  from  the  many  industry  trade 
publications  which  feature  them. 


E.  WHAT  CONTROLS  MAY  CONCEAL 


• Although  a control  process  may  aid  an  organization  to  improve  its  use  of 
computing,  it  may  conceal  past  or  present  problems. 

• The  EDP  organization  may  have  had: 

Long  queues  of  outstanding  work. 

Inefficient  and  costly  development. 
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An  uncooperative  attitude  or  unwillingness  to  listen  or  study  alternative 
methods. 

A lack  of  current  knowledge,  particularly  of  small  system  techniques. 

A lack  of  budget  or  organizational  strengths. 

• Users  may  not  have  been  cooperative  or  willing  to  subject  their  plans  to 
review. 

• Rather  than  study  these  problems  through  a "climate"  survey,  management's 
direct  approach  is  to  set  up  a control  process  that  will  encourage  or  force 
users  and  EDP  to  work  together. 

• There  are,  unfortunately,  no  guarantees  that  the  control  process  will  ensure 
better  discussions. 

Selection  of  equipment  and  development  tasks  in  some  organizations 
suggests  that  users  are  having  their  way  and  taking  short-term  steps  to 
solve  immediate  problems. 

In  other  cases,  EDP  management  is  dominating  the  situation  and 
upgrading  central  capabilities  at  the  expense  of  other  pressing  business 
needs. 

• Either  "solution"  may  have  achieved  meaningful  results,  of  course.  The 
question  for  management  is  whether  the  control  process  allows  those  situa- 
tions to  take  place  without  providing  an  opportunity  for  management  review. 

• Organizations  that  find  themselves  overpopulated  with  smaller  computers  in 
certain  user  areas  or  with  large  expenditures  for  newer  technology  in  a central 
area  should  compare  their  information  processing  capabilities  and  expenditures 
with  those  of  similar  firms. 
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INPUT'S  User  Planning  Service  Annual  Report  is  a good  source  for 
comparative  budget  figures.  Exhibit  IV- 1 I is  a composite  of  data  from 
that  report  that  illustrates  typical  expenditures  in  each  industry  sector. 
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OUTSIDE  SERVICES  AND  SOFTWARE  PURCHASED  BY  NON-EDP  DEPARTMENTS* 
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COMPILED  FROM  INPUT'S  USER  PLANNING  SERVICE  1980  ANNUAL  REPORT 


V THE  NEED  TO  DEVELOP  CONTROLS 


V 


THE  NEED  TO  DEVELOP  CONTROLS 


A.  DEMAND  FOR  AND  GROWTH  OF  USER  SYSTEMS 


• As  Exhibit  V-l  illustrates,  97%  of  respondents  expect  increased  demand  from 
users  for  their  own  systems  and  equipment,  but  only  50%  expect  to  see  growth 
take  place.  The  latter  group  expects  to  guide  and  control  users  within  present 
plans. 

Expansion  is  seen  in  the  use  of  minicomputers,  microcomputers,  office 
automation  and  data  communication  systems. 

There  is  an  expectation  that  lower  priced  minicomputers  and  micro- 
computers will  have  videodisk  and  other  new  storage  technologies  as 
well  as  data  base  capabilities  and  advanced  communication  interfaces. 

• These  smaller  computers  could  have  chip  capabilities  that  will  aid  program 
development  by  producing  coding  that  is  compatible  with  larger  machines. 

• INPUT  projects  that  the  use  of  micros  will  exceed  the  expectations  of  most 
respondents. 

• A study  performed  by  INPUT  in  September  1980  provided  information  on  sales 
of  microcomputers  below  $15,000  in  total  price;  the  results  are  shown  in 
Exhibit  V-2.  The  figures  in  this  exhibit  are  conservative  and  based  upon 
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EXHIBIT  V-l 


DEMAND  FOR  AND  GROWTH  OF  USER  SYSTEMS 
AND  EQUIPMENT  FORESEEN  BY  RESPONDENTS 


COMMENT 

PERCENT 

OF 

RESPONDENTS 

EXPECT  MORE  OR  A GROWING 
DEMAND 

97% 

EXPECT  GROWTH  OF  USER 
SYSTEMS  AND  EQUIPMENT 

50 

(INCLUDES  THE 
GROUP  BELOW) 

EXPECT  A LARGE  OR 
SURPRISING  GROWTH 

30 

THINK  PRESENT  PLANNING 
DOES  NOT  PROVIDE  FOR 
THE  POSSIBLE  CHANGES  IN 
TECHNOLOGY 

20 
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DETERMINATION  OF  ESTIMATED  NUMBERS  OF  VERY  SMALL  SYSTEMS  SOLD  TO  LARGE  CORPORATIONS 

IN  THE  U.S.  BY  1982  AND  1985* 
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TAKEN  FROM  INPUT'S  1980  REPORT,  SELLING  PERSONAL  COMPUTERS  TO  LARGE  COMPANIES.  VOL.  II 
PROFESSIONAL,  TECHNICAL,  MANAGERIAL,  & ADMINISTRATIVE 


assumptions  of  the  number  of  technically  competent  people  who  would  be 
available  in  corporations  to  use  these  microcomputers. 

Experience  during  the  last  six  months  suggests  that  there  will  be  a great 
demand  for  the  use  of  microcomputers  to  handle  small  or  simple  local  user 
requirements,  and  a marketing  effort  by  personal  computer  manufacturers  to 
sell  them  for  this  use  will  intensify. 

A number  of  large  corporations  have  already  started  to  distribute 
microcomputers  to  their  staffs  as  routine  "supply  room"  items. 

A personal  computer  "show"  attended  during  the  study  demonstrated  the 
appeal  that  "user  friendly"  software,  simple  applications,  and  a financial  model 
had  for  a number  of  business  attendees  who  were  not  technically  trained. 

One  hundred  thousand  copies  of  the  microcomputer-based  financial 
modeling  package,  VISICALC,  have  now  been  sold. 

A marketing  manager  at  this  show  had  a list  of  customers  for  the 
personal  computers  that  included  20  names  in  the  Fortune  500. 

An  EDP  manager  of  a major  firm  where  marketing  people  were  buying  micros 
was  contacted  and  asked  whether  he  knew  this  was  happening.  He  was  not 
surprised  and  expected  more  such  instances.  He  referred  to  this  action  as  a 
step  beyond  a calculator. 

During  this  study  INPUT  visited  a corporation  which  had  just  ordered  200 
personal  computers.  One  user  reported  a savings  of  $60,000  with  one  of  these 
units. 

More  powerful  micros  with  canned  programs,  DBMS,  macrolanguages,  and  data 
bases  will  become  common  in  many  offices  and  local  systems  within  the  next 
year. 
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• Micros  connected  to  a typewriter  or  word  processing  unit  will  expand  the  use 
of  computing  still  further. 

• More  business  application  packages  will  be  available  through  word  processing 
and  office  automation  systems.  A developer  was  contacted  who  has  imple- 
mented an  advanced  financial  modeling  system  for  a word  processing  vendor 
(as  well  as  for  a new  micro). 

• Three  respondents  felt  that  micros  were  little  more  than  toys  and  should  be 
discouraged  from  use.  One  company  claimed  that  one  will  soon  feel  limited 
with  a micro  or  even  with  a mini.  An  executive  in  charge  of  management 
science  applications  at  a large  firm,  who  expressed  this  idea,  was  interviewed. 

When  asked  to  identify  small  applications  that  were  now  being  done  on 
a repetitive  basis  in  marketing  and  operations  areas,  he  noted  present 
value  and  purchase/lease  calculations,  among  other  applications. 

Asked  to  compare  the  cost  of  doing  these  jobs  on  internal  timesharing 
over  a period  of  months  versus  the  cost  on  a personal  computer,  he 
agreed  that  there  would  be  a justification  for  personal  computers  in 
many  offices  on  this  basis,  and  modified  his  position  to  refer  to  serious 
applications  of  computing. 

After  reviewing  data  base  capabilities  and  languages  now  available  on 
some  micros,  he  expressed  concern  that  users  could  consider  these  tools 
for  larger  applications. 


B.  REACTION  TO  GROWTH 


• A high  percentage  of  respondents  feel  that  there  will  be  more  control  and 
guidance  of  users  and  expect  an  increase  in  controls,  as  noted  in  Exhibit  V-3. 
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EXHIBIT  V-3 


ANTICIPATED  INCREASE  IN  CONTROLS/GUIDANCE 


GROUP 
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• Respondents  also  emphasized  that  there  will  be  a need  for  new  strategies  and 
techniques  in  working  with  users.  They  suggested  that  EDP  management  will 
have  to  develop  more  presentations  and  education  that  will  guide  users. 

• Two  respondents  emphasized  that  study  was  needed  on  the  potential  security 
problems  and  misuses  of  information  and  equipment  that  could  take  place  with 
small  user  systems. 

• Respondents  were  particularly  concerned  with  limiting  what  users  could  do,  as 
shown  in  Exhibit  V-4.  A significant  point  is  that  respondents  wanted  to  limit 
users  in  the  future,  as  shown,  whatever  controls  existed  or  came  into  effect. 
It  was  felt  that  limitations  might  not  be  stated  as  succinctly  as  this  in  a 
control  process,  but  that  EDP  management  would  need  these  controls  to 
ensure  that  computing  was  used  effectively. 

• Respondents  did  not  express  the  opinion  that  users  should  be  denied  access  to 
new  technology,  however. 

• Many  respondents  noted  that  EDP  management  might  have  more  effect  in 
limiting  users  if  EDP  management  was  recognized  as  the  source  of  aid  or  help 
in  the  future,  whenever  users  heard  about  new  equipment  or  software. 

C.  ARE  CONTROLS  NECESSARY? 


• Respondents  from  93%  of  the  companies  that  were  interviewed,  including  six 
companies  that  do  not  have  any  controls  now,  felt  that  controls  in  some  form 
would  be  necessary  in  the  next  few  years,  if  not  immediately. 

• Sixty-three  percent  of  all  respondents  expect  existing  controls  to  increase. 
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EXHIBIT  V-4 


FUTURE  LIMITATIONS 
DESIRED  BY  RECIPIENTS 


LIMITATION 
ON  USERS 

ILLUSTRATION 

PERCENT  OF 
RESPONDENTS 
WHO  MENTIONED 

APPLICATION 

SHOULD  NOT  BE  CORE  APPLICA- 
TIONS SUCH  AS  PAYROLL  OR 
GENERAL  LEDGER  OR  COMPLEX 
IN  NATURE 

77% 

DATA 

COMMUNI- 

CATIONS 

SHOULD  BE  COMPATIBLE  TO 
CENTRAL  FACILITY 

67 

EQUIPMENT 

SHOULD  BE  RESTRICTED  TO  A 
LIST  OF  TROUBLE  FREE  AND 
WELL  USED  COMPUTERS 

63 

SOFTWARE 

SHOULD  USE  HIGHER  LEVEL 
APPLICATION  LANGUAGES 

67 
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• Managers  fear  that  lower  cost  minis  or  micros  with  data  base  and  higher 
language  capabilities  could  lead  users  to  repeat  the  gruesome  learning 
experience  of  early  data  processing  organizations  unless  guidance  is  provided. 

• EDP  management  must  stay  aware  of  user  plans  and  attempt  to  control  or 
guide  the  use  of  computing. 

This  should  be  considered  to  be  part  of  the  mission  of  EDP. 

If  not  done,  one  user  respondent  executive  noted  that  users  are  apt  to 
feel  EDP  is  at  fault  when  problems  occur,  even  when  users  act  on  their 
own. 

Attempting  to  work  with  users  or  staying  close  to  them  can  lessen  the 
impact  of  problems  and  extend  the  influence  of  EDP,  as  shown  in  this 
study. 

• If  EDP  management  observes  that  problems  are  occurring  with  user-operated 
systems,  or  that  good  practices  and  standards  are  not  being  followed,  steps 
should  be  taken  to  change  the  situation. 

The  first  step  should  be  to  persuade  or  educate  the  user  to  follow  good 
practices  and  standards. 

It  could  also  be  necessary  to  reinforce  older  controls  or  attempt  to 
introduce  new  ones. 

• There  are  situations  where  older  controls  (such  as  the  controls  that  apply  to 
expenditures  through  a purchasing  department)  have  continued  to  work.  Other 
factors  are  often  operative  in  these  situations,  as  Exhibit  V-5  illustrates. 

Six  respondents  with  older  controls  offered  low-cost  internal  time- 
sharing to  users,  combined  with  consulting  aid. 
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EXHIBIT  V-5 


EFFECT  OF  OTHER  FACTORS 
WHERE  CONTROLS  HAVE  NOT  INCREASED 


PROBLEM 

LEVEL* 

REPORTED  BY 
RESPONDENT 

AVAILABILITY 

OF 

INTERNAL 

TIMESHARING 

HOW  EDP  WORKS  CLOSELY  WITH  USERS 

0 

— 

HAS  VENDORS  INSTALL  MINIS 
FOR  USERS 

9 

X 

0 

X 

6 

X 

2 

— 

INSTALLS  MINIS  FOR  USER  SYSTEMS 

2 

X 

8 

X 

0 

— 

EMPHASIZES  DDP  AND  WORKING 
CLOSELY  WITH  USERS 

0 

X 

OFFERS  DDP  WITH  AID  TO  USERS 

1 

— 

PROVIDES  SOFTWARE  FOR  DECEN-  - 
TRALIZED  MINIS 

*AS  DEFINED  IN  EXHIBIT  1 1 1-9 
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Two  of  these  respondents  had  high  problem  levels,  however. 


In  a situation  with  older  controls,  one  respondent  was  instructed  by  his 
management  to  make  one  last  try  to  serve  users  through  the  data 
processing  organization.  If  it  did  not  work,  the  users  were  going  to  be 
given  the  authority  to  run  their  own  systems.  This  respondent  worked 
closely  with  users  to  make  sure  their  priorities  were  met  and  that 
backlogs  were  reduced.  His  actions  produced  the  rapprochement  with 
users  that  a new  control  process  has  produced  elsewhere. 

• This  suggests  that  EDP  management  can  try  other  steps  before  attempting  to 
increase  controls. 

• The  introduction  or  increase  of  controls  occurred  at  most  companies  where 
respondents  had  found  problems  resulting  from  user  activities. 

At  those  companies,  the  control  process  became  the  method  by  which 
users  and  the  EDP  organization  began  to  work  on  problems  together. 

The  business  objectives  of  the  user  and  longer  range  concerns  for  the 
use  of  computing  came  to  the  surface  through  the  control  process  as 
well. 


D.  A PROGRAM  FOR  CONTROLS/GUIDANCE 


• This  section  is  based  upon  the  assumption  that  a decision  is  being  made  to 
increase  or  impose  controls  or  guidance  by  corporate  management  and/or  EDP 
management. 

• The  elements  of  the  program  that  were  identified  during  this  study  include: 

Participation  and  role  of  users. 
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Participation  of  corporate  management. 


Role  of  the  EDP  department. 

The  process  used  to  enforce  or  administer  the  controls. 

The  controls  chosen. 

A strategy  or  mission  statement  for  the  control  process. 

A marketing  role  or  attitude  by  the  EDP  organization. 

Supplementary  equipment  capabilities. 

Letting  users  acquire  their  own  capabilities  when  needed. 

Selections  or  choices  in  regard  to  these  elements  are  shown  in  Exhibit  V-6  for 
respondents  who  rate  their  success  as  entirely  or  mostly  acceptable. 

It  may  be  difficult  for  EDP  management  to  bring  about  the  participation  of 
users  without  "selling"  corporate  management  first.  A presentation  to  users 
(and  corporate  management)  has  been  used  to  note  the  benefits  of  a control 
process.  Benefits  such  as  those  noted  in  Chapter  IV  have  been  stressed. 

Corporate  management  has  to  give  its  blessing  to  the  control  process  to  ensure 
that  users  realize  they  will  be  aided  by  the  process  and  that  they  should 
conform  with  it. 

Users  should  feel  that  their  business  needs  will  be  served  in  a timely  fashion, 
according  to  their  own  and  overall  business  priorities,  or  that  other  solutions 
can  be  considered. 
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EXHIBIT  V-6 


ELEMENTS  OF  A CONTROL  PROCESS 


ELEMENT 


TOP  MANAGEMENT 
INVOLVED  IN 
INTRODUCTION  OF 
CONTROLS 

EDP  INVOLVED  IN 
INTRODUCTION 


BUDGET/FINANCIAL 
CONTROLS  USED 


EDP  USES 

MARKETING  SKILLS 

USERS  ALLOWED  TO 
JUSTIFY  RCS 
SERVICE 

MISSION  STATEMENT 
DEVELOPED 


INTERNAL  TIME- 
SHARING AVAILABLE 

USERS  INVOLVED 
IN  INTRODUCTION 
OF  CONTROLS 


EDP  HAS  ENFORCE- 
MENT ROLE 


REVIEW  TECHNIQUES 
USED 


DDP  AVAILABLE 


USERS  ALLOWED 
TO  JUSTIFY /OBTAIN 
STANDALONE  COM- 
PUTERS 

0 20  40  60  80  100% 

PERCENT  OF  SUCCESSFUL  RESPONDENTS 
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Users  should  also  feel  that  efforts  will  be  made  to  support  a long-range  EDP 
plan  for  the  corporation,  and  that  they  will  be  made  aware  of  that  plan  and  the 
costs  associated  with  it. 

Based  on  the  general  experience  of  respondents,  the  administration  of  the 
control  process  may  resemble  Exhibit  V-7. 

The  strategy  or  mission  statement  for  controls/guidance  was  written  by  75% 
of  respondents  after  the  controls  were  instituted.  This  may  be  a wise 
precedent,  since  it  provides  an  opportunity  to  answer  initial  criticisms  or 
problems. 

The  marketing  or  consulting  role  of  EDP  could  be  satisfied  by  assigning 
systems-trained  people  to  work  with  users  or  actually  transferring  them  to  the 
user  staff. 

This  role  and  the  mission  statement  should  incorporate  the  theme  that  the 
EDP  organization  is  the  spokesman  for  the  effective  use  of  computing  within 
the  entire  organization. 

The  control  process  should  be  structured  so  that  it  can  adapt  itself  and  change 
to  meet  changing  technology,  the  business  needs  of  the  firm,  or  the  progress 
and  development  of  the  EDP  organization. 

The  control  process  and  any  organizational  change  that  takes  place  to  guide 
users  should  try  to  improve  the  effectiveness  of  computing  for  the  organiza- 
tion as  a whole. 

This  means  that  the  control  process  must  support  a planning  and  budgeting 
function  carried  out  by  EDP  management,  a steering  committee,  or  a 
corporate  planning  function  at  the  executive  level.  It  should  coordinate  and 
direct  computing  and  communications  plans  to  meet  longer  range  EDP 
strategies  and  to  ensure  that  they  are  in  support  of  and  justified  by  business 
objectives. 
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POSSIBLE  ADMINISTRATION  OF  THE  CONTROL  PROCESS 


Users  document  requests  for  application  development  (other  than 
budgeted  maintenance)  with  a review  of  benefits  and  an  indication 
of  priority.  The  EDP  or  MIS  department  aids /consults  as  needed 
and  helps  to  prepare  a forecast  of  future  needs.  An  equipment 
capability  may  be  recommended  if  EDP  will  not  be  able  to  accommo- 
date the  request. 

Requests  are  submitted  for  review  by  a group  including  EDP, 
corporate,  and  user  management  representatives  who  construct 
an  overall  list  of  priorities  and  planned  expenditures.  The  EDP 
department  compares  requests  to  forecasts  of  needs. 

Regular  (monthly,  etc.)  meetings  are  held  to  review  all  requests,  or 
just  those  that  the  review  group  selects  for  review  (which  might 
include  items  not  included  in  forecasts,  or  user  plans  for 
equipment  that  appeared  incompatible,  risk  prone,  etc.). 
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APPENDIX 


: PROFILE  OF  RESPONDENTS 


APPENDIX  A: 


PROFILE  OF  RESPONDENTS 


Airlines  I 

Commercial  Banks  4 

Chemical  Manufacturers  I 

Drug  Manufacturers  I 

Electrical  Manufacturers  3 

Food  Manufacturers  1 

Government  I 

Insurance  4 

Petrochemical  2 

Photographic  Equipment  I 


• Publishers  2 

• Security  Industry 

and  Brokerage  Firms  4 

• Transportation  3 

• Utilities  2 
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: QUESTIONNAIRE 


CATALOG  NO. 


uiBiaigw 


CONTROLLING  USER  OPERATED  SYSTEMS  & EQUIPMENT 

QUESTIONNAIRE 


What  methods  does  your  company  employ  to  track  or  stay  aware  of  user  operated 
systems  and  equipment? 

IF  YES,  PLEASE  GIVE  AN 
EXAMPLE  OR  COMMENT 


We  don’t  try  to. 

( )YES  ( )NO 

Budgeting/Financial 
( )YES  ( )NO 


Purchasing  (control  of  vendors 
such  as  an  approved  list). 

( )YES  ( )NO 


User  reporting. 

( )YES  ( )N0 


EDP  activity  such  as  audits. 
( )YES  ( )N0 

"The  grapevine". 

( )YES  ( )NO 


Other. 
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How  extensive  are  user  operated  systems  and  equipment  in  your  company 
compared  to  the  EDP  budget? 

Please  check  the  figure  which  is  appropriate. 

( ) Less  than  1% 

( ) 1-5% 

( ) 5-1 0% 

( ) 10-20% 

( ) 20-30% 

( ) 30-40% 

( ) More  then  40% 

What  is  the  actual  figure,  if  it  is  available. 


Is  this  figure: 

(Please  check  all  that  are  appropriate.) 

Included  in  user  budgets.  ( ) 

Included  in  the  EDP  budget.  ( ) 

Provided  by  your  accounting 

system  rather  than  a best 

estimate.  ( ) 

A question  on  the  type  of  departments  using  such  equipment  or  services  and 
its  size  would  be  answered  by  an  update  or  manipulation  or  the  results  of 
question  3a  in  source  A. 
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How  would  you  classify  your  user  operated  systems?  (Check  the  classes  that 
apply  to  your  system.) 

NOTE:  Please  refer  to  the  definitions  that  follow  or  ask  for  comments. 

( ) Part  of  a network. 

( ) Part  of  a DDP  plan  (where  users  have  local  control  of  a computer 

with  its  own  storage  of  files  that  is  connected  to  a network). 

( ) Uncentralized  or  standalone. 

( ) Computers  or  terminals  connected  to  a vendor  service. 

( ) Other. 

A question  on  the  classification  of  user  operated  equipment  will  be  answered 
by  question  2a  in  the  source  noted  for  question  3 above. 

Who  has  been  assisting  users  to  develop  systems  and  install  and  operate  computers? 
Please  check  all  that  apply. 


DEVELOP 

INSTALL 

OPERATED 

No  one. 

( ) 

( 

) 

( ) 

EDP  organization 

( ) 

( 

) 

( ) 

Vendors  of  equipment 
and  software. 

( ) 

( ) 

( ) 

Vendors  of  time  sharing 
and  remote  computing 
services. 

( ) 

( 

) 

( ) 

Consultants. 

( ) 

( 

) 

( ) 
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7.  What  traditional  benefits  do  users  attribute  to  user  operated  systems  and 

equipment?  Please  check  all  that  apply;  then  check  the  column  that  applies 
to  each  benefit  category  in  general  and  note  who  audited  the  benefits  (if  anyone 
did). 


Benefits 
Were  Less 
Than  Costs 

Benefits 
Were  Equal 
To  Or  Above 
Costs 

Benefits 
Were  Much 
Greater  Than 
Costs 

Who 

Audited 

The 

Benefits 

Cost  savings 

( 

) 

( 

) 

( 

) 

( 

) 

Revenue 

( 

) 

( 

) 

( 

) 

( 

) 

Support 

( 

) 

( 

) 

( 

) 

( 

) 

Control 

( 

) 

( 

) 

( 

) 

( 

) 

Other 

( 

) 

( 

) 

( 

) 

( 

) 

8.  Do  users  also  attribute  any  of  the  following  benefits  to  these  systems  and 
equipment?  Check  as  many  as  apply. 


( ) 
( ) 
( ) 
( ) 
( ) 
( ) 
( ) 


Didn't  wait  for  assistance  from  EDP. 

Development  was  rapid. 

It  is  easy  to  modify,  change,  or  experiment  with  the  system. 
It  was  more  economic  than  using  EDP. 

The  system  was  built  with  more  quality  or  capability. 

The  operating  environment  is  more  flexible. 

Other. 
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10.  If  the  cost  of  overcoming  the  problems  listed  for  question  9 were  exhorbitant, 
what  did  you  do?  Please  check  the  answer  that  applies  most. 

( ) Threw  out  the  system. 

( ) Lived  with  the  system  as  it  was. 

( ) Paid  the  exhorbitant  cost. 

I I.  Have  controls  been  imposed  or  increased  for  user  operated  systems  and  equipment? 


( ) Improved 

( ) Increased 

( ) No  change,  there  are  controls  in  effect. 

( ) We  have  no  controls. 

12.  Who  has  been  involved  with  the  controls  and  what  role  did  they  play?  Please 
indicate  the  roles  of  each  party  listed  at  the  left  by  checking  the  columns 
noting  their  roles. 


Involved  In 
Decision  To 
Increase  A 
Impose 
Controls 


User  areas  ( ) 

Corporate  management  ( ) 

Controller  ( ) 

EDP  management  ( ) 

Outside  consultant  ( ) 

Other.  Please  list 
below 

( ) 

( ) 

( ) 


Introduced 

Controls 

Enforced 

Controls 

Developed  A 
Strategy  For 
Imposing 
Controls 

( ) 

( ) 

( ) 

( ) 

( ) 

( 

) 

( ) 

( ) 

( ) 

( ) 

( ) 

( 

) 

( ) 

( ) 

( ) 

( 

) 

( 

) 

( 

) 

( 

) 

( 

) 

( 

) 

( 

) 

( 

) 

( 

) 
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What  was  the  perception  of  the  EDP  organization  before  controls  were  established? 
Check  all  that  apply. 


( 

) 

Cumbersome 

( 

) 

Too  busy  to  ask  for  aid. 

( 

) 

Educational/helpful 

( 

) 

Passive 

( 

) 

Other.  Please  describe. 

What  objectives  were  controls  supposed  to  achieve?  Check  as  many  as  apply; 
try  to  limit  the  number. 

( ) Reduce  costs. 

( ) Avoid  problems. 

( ) Aid  users. 

( ) Serve  business  strategies. 

( ) Support  EDP  strategies. 

( ) Other.  Please  list  below. 


If  more  than  two  of  the  above  answers  were  checked,  which  two  objectives 
were  most  important? 
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16.  Could  any  of  the  control  methods  that  were  introduced  be  characterized  as 
the  following?  Please  check  all  that  apply. 

i 

EXAMPLES/COMMENTS 

( ) Standards  for  the  equipment  that  may  

be  used. 


( ) Standards  for  the  software  that  may 
be  acquired  or  used  for  development. 

( ) Standards  for  the  actual  or  potential 
communication  of  data. 


( ) Standards  for  accounting  and  other 
business  conventions. 


( ) Standards  for  the  development,  

implementation,  testing,  operation, 

documentation,  training  etc.  for  

applications. 

( ) Budgetary  controls  on  the  level  of 

EDP  expenditures  that  can  be  made  

without  approval.  

( ) Budgetary  controls  that  require  reporting  

of  all  EDP  expenditures.  

( ) Budgetary  controls  that  add  overhead  

charges  to  all  EDP  expenditures.  

( ) Techniques  of  controlling  or  guiding  users  

through  user  aid  or  consulting.  

( ) Techniques  of  requiring  the  approval  of  

the  EDP  Dept,  or  another  office  or  council  

for  all  EDP  related  expenditures. 
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Techiques  of  using  an  approval  process  for 
EDP  expenditures  by  users  that  has  delays 
or  required  justification  forms  which 
provide  an  opportunity  to 
review  user  plans 

Techniques  of  guiding  users  though  audits 
of  their  budgets,  plans,  and  activities 
related  to  EDP. 

What  other  methods  of  control  were  used? 


How  was  the  effectiveness  of  control  measured?  More  than  one  may  be  checked. 

( ) User  survey. 

( ) Budget  review. 

( ) EDP  study. 

• ( ) Consultant  study. 

( ) Reporting  from  user. 

( ) Reporting  from  purchasing. 

( ) Other.  Please  describe. 
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How  would  you  rate  your  success  in  controlling  user  systems  and  equipment? 
Please  check  the  appropriate  column  for  each  method. 


HIGH 

MEDIUM 

Standards 

( ) 

( ) 

Budgets 

( ) 

( ) 

Techniques 

( ) 

( ) 

Other 

( ) 

( ) 

Were  your  objectives  for  users  obtained? 


LOW  NOT  USED 


( 

) 

( 

) 

( 

) 

( 

) 

( 

) 

( 

) 

( 

) 

( 

) 

Please  check  the  answer  that  is  most 


appropriate  and  provide  us  some  comment/example. 


( 

) 

Wholly 

( 

) 

Partially 

( 

) 

Somewhat  or 

in  some  cases 

Did  you  develop  a strategy  for  imposing  control  methods?  Please  indicate 
when  it  was  developed. 

( ) Before  the  control  methods  were  chosen. 

( ) Before  they  were  imposed. 

( ) During  the  period  that  they  were  introduced. 

( ) After  their  introduction. 

( ) No  strategy  was  utilized. 
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What  role  has  EDP  taken  since  controls  were  introduced?  Check  as  many 
as  apply. 


( 

) 

Report  on  user  activity. 

( 

) 

Administer  controls. 

( 

) 

Control  access  to  vendors. 

( 

) 

Educate  users. 

( 

) 

Consulting  aid. 

( 

) 

Marketing  attitude. 

( 

) 

Other. 

Did  the  increase  in  controls  result  in  the  following? 


Increased  user  ability  to  meet  needs.  Please  check  the  appropriate  comments. 
( ) Definitely 

( ) In  some  cases. 

( ) Possibly 

( ) No  impact. 

Support  of  network  or  ADP  strategy. 

( )YES  ( )NO 
( ) Somewhat 
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25.  Growth  or  decrease  of  user  operated  systems  and  equipment: 


( 

) 

Large  growth. 

( 

) 

Same  growth. 

( 

) 

No  change. 

( 

) 

Decrease. 

26.  The  desired  growth  or  decrease  in  user  systems  and  equipment  was  obtained. 

( ) YES  ( ) NO 
( ) Not  sure  or  don't  know. 

27a.  Increase  in  the  capability  of  moving  applications  from  all  user  site  to  another. 
Please  check  the  appropriate  answer. 

( ) Yes,  it  was  achieved  and  done. 

( ) Yes,  but  it  was  not  done. 

( ) No,  it  wasn't  achieved. 

( ) We  always  had  this  capability. 

27b.  If  "d"  is  checked,  please  iet  us  know  how  you  verified  the  capability. 


28.  Selection  of  user  objectives  that  support  the  following. 

( ) Business  objectives. 

( ) Long  range  EDP  plans. 
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Less  diversion  of  user  personnel  from  important  functional  assignments  to 
routine  EDP  job.  Please  check  the  one  most  appropriate. 


( 

) 

Definitely 

( 

) 

Possibly 

( 

) 

No  change 

( 

) 

Dont'  know 

Was  this  result  what  was  desired? 

( )YES  ( ) NO 

Better  evaluation  and  selection  of  hardware  and  software.  Both  may  be  checked. 

( ) Hardware 

( ) Software 

Increased  or  decreased  the  support  burden  for  EDP. 

( ) Definitely  increased. 

( ) Possibly  increased. 

( ) No  change. 

( ) Definitely  decreased. 

( ) Possibly  decreased. 
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Increased  the  quality  of  any  of  the  following: 

( ) Specifications  for  user  job. 

( ) System  design. 

( ) Programming. 

( ) Testing. 

( ) Conversion. 

( ) Operation  of  system. 

( ) Documentation. 

( ) Maintenance  of  equipment. 

( ) Maintenance  of  software. 

( ) Procedure  for  enhancing  or  changing  the  system. 

Increased  the  use  of  software  packages  such  as  financial  modeling,  DBMS, 
etc.,  in  user  systems.  Please  check  one  of  the  following;  list  the  type/name 
if  YES. 

( ) YES 

( ) NO 

Increased  the  use  of  productivity  aids.  Please  check  one  of  the  following. 

( ) YES 

( ) NO 
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35.  What  do  you  think  that  the  future  holds  for  user  operated  systems  and  equipment? 
Please  comment  if  you  have  opinions  or  ideas. 


36.  Should  users  be  limited  in  regard  to  applications,  data  communication  size 
of  equipment,  use  of  software  to  a further  extent  than  controls  presently 
allow?  Please  add  comments  where  appropriate. 

( ) Applications 

( ) Data  communication  

( ) Size  or  type  of  equipment  

( ) Software  

( ) Other.  
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